Gabriel Dusil
VP, Global Sales & Marketing
www.facebook.com/gdusil
cz.linkedin.com/in/gabrieldusil
gdusil.wordpress.com
dusilg@gmail.com
Download the native PowerPoint slides here:
 http://gdusil.wordpress.com/2012/04/15/anatomy-of-advanced-persistentthreats/
Or, check out other articles on my blog:
 http://gdusil.wordpress.com
Experts in Network Behavior Analysis
Page 2, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Old threats were IT Oriented
 Fame & Politics
 Boredom & Personal Challenge
Criminals now take a strategic
approach to cybercrime
 Companies now compensate by
building higher walls
New threats focus on ROI
 Fraud & Theft
Battles may have been
won & lost on both sides…
…But the war is far from over.
Experts in Network Behavior Analysis
Page 3, www.cognitive-security.com
© 2012, gdusil.wordpress.com
People + Process + Technology = Business Challenges
4
Experts in Network Behavior Analysis
Page 4, www.cognitive-security.com
© 2012, gdusil.wordpress.com
• A bug, glitch, hole, or flaw in
a network, application or
database
• Attack developed to take
advantage of a vulnerability
• Attack on a selection of
vulnerabilities to control a
network, device, or asset
• Software designed to fix a
vulnerability and otherwise
plug security holes
• Attack against an unknown
vulnerability, with no known
security fix
 Methodical, longterm covert attacks, using
many tools to steal info
Experts in Network Behavior Analysis
Page 5, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Blended
Threats
• Include embedded URLs that link to an infected Web page
• Employ social engineering to encourage click-through.
Infected
Websites
• Victim visits legitimate site infected by malware (eg. Cross Site
Scripting, or iFrame compromise)
Malware
Tools
• Back-door downloaders, key loggers, scanners & PW stealers
• Polymorphic design to escape AV detection
Infected
PC (bots)
• Once inside the, infiltrating or compromising data is easy
• Some DDoS attacks can originate from internal workstations
Command&
Control (C2)
• Remote servers operated by attacker control victim PCs
• Activity occurs outside of the normal hours, to evade detection
Management
Console
• Interface used to control all aspects of the APT process
• Enables attackers to install new malware & measure success
Experts in Network Behavior Analysis
Page 6, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Unclassified
Behavior Unexpected
Anomaly
Peer 2 Peer
Network
Behavior
Heavy DNS
Use &
Sophisticated
Scans
Advanced
Persistent
Threats
Outbound
Encrypted
sessions
(eg. SSH)
Periodic
Polling
- Command
& Control
Unexpected
new service
or Outlier
Client
Experts in Network Behavior Analysis
Page 7, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Web Browsers
 IE, Firefox, Opera,
Safari, Plugins
7. App
Applications
 Adobe Flash,
Codecs,
QuickTime
Rich Complex
Environments
 Java, Flash,
Silverlight,
.NET & J2EE
10% App
8. Web
Presentation
5. Session
4. Transport
3. Network
2. Data
1. Physical
• HTTP, SMTP, FTP
• SSL, TLS
• TCP, SIP
80%
Apps
90%
Network
• TCP, UDP
• IP
• 802.11, FDDI, ATM
• 1000Base-T, E1
20%
Network
% of
Security
Attacks
% of
Security
Spending
Experts in Network Behavior Analysis
Page 8, www.cognitive-security.com
© 2012, gdusil.wordpress.com
IBM - X-Force (Mid-year Trend & Risk Report '11
Experts in Network Behavior Analysis
Page 9, www.cognitive-security.com
© 2012, gdusil.wordpress.com
IBM - X-Force (Mid-year Trend & Risk Report '11
Experts in Network Behavior Analysis
Page 10, www.cognitive-security.com
© 2012, gdusil.wordpress.com
“The Zeus Trojan…,
….will continue to receive
significant investment
from cybercriminals
in 2011.”
“The aptly named
Zeus,… …targeting
everything from bank
accounts to government
networks, has become
extremely sophisticated
and is much more.”
Cisco - Annual Security Report '11
Experts in Network Behavior Analysis
Page 11, www.cognitive-security.com
© 2012, gdusil.wordpress.com
“Going into 2012,
security experts
are watching
vulnerabilities in
industrial control
systems &
supervisory
control & data
acquisition
systems, also
known as
ICS/SCADA.”
Cisco - Annual Security Report '11
Experts in Network Behavior Analysis
Page 12, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Cisco - Annual Security Report '11
Experts in Network Behavior Analysis
Page 13, www.cognitive-security.com
© 2012, gdusil.wordpress.com
 “[Hacking] Breaches… …can be
because
they may contain sensitive data on clients as well as employees that even an
average attacker can sell on the underground economy.”
Source: OSF DataLoss DB,
Symantec – Internet Security Threat Report ‘11.Apr
Experts in Network Behavior Analysis
Page 14, www.cognitive-security.com
© 2012, gdusil.wordpress.com
*Verizon – ‘11 Data Breach Investigations Report
Experts in Network Behavior Analysis
Page 15, www.cognitive-security.com
© 2012, gdusil.wordpress.com
% breaches / % records
footprinting and fingerprinting) - automated scans for open ports &
services
Experts in Network Behavior Analysis
Page 16, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Primarily targets are bank accounts
McAfee Threats Report, Q2 ‘10
Experts in Network Behavior Analysis
Page 17, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Up to 6000 different botnet
Command & Control (C&C)
servers are running every day
 Each botnet C&C controls an
average of 20,000 compromised
bots
 Some C&C servers manage
between 10’s & 100,000’s of bots
Symantec reported an average
of 52.771 new active botinfected computers per day
Arbor Networks Atlas - http://atlas.arbor.net/summary/botnets
ShadowServer Botnet Charts - www.shadowserver.org/wiki/pmwiki.php?n=
Stats.BotnetCharts
Experts in Network Behavior Analysis
Page 18, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Friday is the busiest day for
new threats to appear
May 13 - June 4, 2010
 Increased Zeus &
other botnet activity
McAfee Threats Report, Q1 ‘11
Experts in Network Behavior Analysis
Page 19, www.cognitive-security.com
© 2012, gdusil.wordpress.com
% breaches / % records
Verizon – ‘11 Data Breach Investigations Report
Experts in Network Behavior Analysis
Page 20, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Gartner estimates that the global market for dedicated NBA revenue
will be approximately $80 million in 2010 and will grow to
approximately $87 million in 2011
 Gartner
Collecting “everything” is typically considered overkill. Threat
Analysis at line speeds is expensive & unrealistic – NetFlow analysis
can scale to line speeds, & detect attacks
 Cisco
“…attacks have moved from defacement and general annoyance to
one-time attacks designed to steal as much data as possible.”
 HP
HP – Cyber Security Risks Report (11.Sep)
Gartner - Network Behavior Analysis Market, Nov ’10
Cisco - Global Threat Report 2Q11
Experts in Network Behavior Analysis
Page 21, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Cisco - Global Threat Report 2Q11
Experts in Network Behavior Analysis
Page 22, www.cognitive-security.com
© 2012, gdusil.wordpress.com
McAfee – Revealed, Operation Shady RAT
Experts in Network Behavior Analysis
Page 23, www.cognitive-security.com
© 2012, gdusil.wordpress.com
http://dealbook.nytimes.com/2011/03/18/ex-goldman-programmersentenced-to-8-years-for-theft-of-trading-code/
Experts in Network Behavior Analysis
Page 24, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Experts in Network Behavior Analysis
Page 25, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Challenges










Integrate with SIEM
Provide a way for automated blocking
Handling of high bandwidth traffic
Mapping IP addresses to subscribers
Processing of incidents
5x7 and 24x7 support
Handling links with minimum latency
No additional point-of-failure
No modifications of the existing infrastructure
Integrate into the existing reporting
Experts in Network Behavior Analysis
Page 26, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Protect critical network
infrastructure
 Legacy network
 Traffic going to the Internet
 Internal VOIP traffic
Protect Cable & GPRS
subscribers






Botnets
DNS attacks
Zero-day attacks
Low-profile attacks
SYN flood & ICPM attacks
Service misuse
Protection against
APT, zero-day attacks, botnets
and polymorphic malware
Experts in Network Behavior Analysis
Page 27, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Protection of design secrets
 Throughout the R&D process
 High-end databases from theft
Databases contain
development & testing of new
compounds & medicines.
 Theft of Intellectual Property
 Secrets lost to competitors or
foreign governments
Security is needed to protect
Corporate Assets
 Sales Force Automation, Channel
Management, CRM systems,
Internet Marketing
C-T.P.A.T - Customs & Trade Partnership Against Terrorism,
http://www.cbp.gov/xp/cgov/import/commercial_enforcement/ct
pat/
Experts in Network Behavior Analysis
Page 28, www.cognitive-security.com
© 2012, gdusil.wordpress.com
A Global Industry
 Exposed to security risks from
competitors or government
sponsored attacks
Supply Chain Security
 R&D  chemicals  production
 sales channels
 Cross-Country & Cross-Company
 Indian & Chinese emergence
 Chemicals used for terrorism
Mandatory retention of data
 Protection from APT attacks
 Unauthorized access from both
internal and external agents
REACH - Registration, Evaluation, Authorization and Restriction of
Chemicals is a European Union law, regulation 2006/1907 of 18
December 2006. - REACH covers the production and use of
Experts in Network Behavior Analysis
Page 29, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Cybersquatting
 Registration of domain
names containing a brand,
slogan or trademark to
which the registrant has
no rights
Understanding the
topology across
the Supply Chain
can assist security
experts in
identifying potential
weak spots
UKSPA - What are the top security threats facing the research sector? http://www.ukspa.org.uk/news/content/2562/what_are_the_top_security_th
reats_facing_the_research_sector
Experts in Network Behavior Analysis
Page 30, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Behavioral Analysis
Security Monitoring
Incident Response
Cyber-Attack Detection
Maximize QoS
Attack Validation
Attack Location ID
Risk Analysis
Blocking Policies
IP or AS blocking
Inform Subscriber
IP = Internet Protocol, AS = Autonomous System, QoS =
Quality of Service, SRMB = Security Risk Minimal
Blocking
Experts in Network Behavior Analysis
Page 31, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Using
NetFlow to
support
incident
response
Take an
analytical
approach to
detecting
APTs.
Use location
IDs so alerts
are more
“humanreadable,”
Baseline, to
detect
anomalous
events.
Collaborate
& share
knowledge.
Combining the above approaches can help security teams more
quickly identify and remediate intrusions and help avoid potential
losses.
Cisco - Global Threat Report 2Q11
Experts in Network Behavior Analysis
Page 32, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Experts in Network Behavior Analysis
Page 33, www.cognitive-security.com
© 2012, gdusil.wordpress.com
“Advanced Persistent Threats”, or APTs, refers low-level attacks used
collectively to launch a targeted & prolonged attack. The goal is to gain
maximum control into the target organization. APTs pose serious concerns
to a security management team, especially as APT toolkits become
commercially and globally available. Today’s threats involve polymorphic
malware and other techniques that are designed to evade traditional
security measures. Best-in-class security solutions now require controls
that do not rely on signature-based detection, since APTs are “signatureaware”, and designed to bypass traditional security layers. New methods
are needed to combat these new threats such as Behavioral Analysis.
Network Behavior Analysis proactively detects and blocks suspicious
behavior before significant damage can be done by the perpetrator. This
presentation provides some valuable statistics in the growing threat of
APTs.
Experts in Network Behavior Analysis
Page 34, www.cognitive-security.com
© 2012, gdusil.wordpress.com
Network Behavior Analysis, NBA, Cyber Attacks, Forensics Analysis,
Normal vs. Abnormal Behavior, Anomaly Detection, NetFlow, Incident
Response, Security as a Service, SaaS, Managed Security Services,
MSS, Monitoring & Management, Advanced Persistent Threats, APT,
Zero-Day attacks, Zero Day attacks, polymorphic malware, Modern
Sophisticated Attacks, MSA, Non-Signature Detection, Artificial
Intelligence, A.I., AI, Security Innovation, Mobile security, Cognitive
Security, Cognitive Analyst, Forensics analysis, Gabriel Dusil
Experts in Network Behavior Analysis
Page 35, www.cognitive-security.com
© 2012, gdusil.wordpress.com